Question 1

How quickly can an assessment start?

Accepted Answer

Most standard assessments start within 10 business days of a signed scope. Red team campaigns usually need 3-4 weeks for planning and rules-of-engagement approval. Incident response starts immediately.

Question 2

Will testing disrupt production?

Accepted Answer

Testing runs inside agreed windows, with rate limits and prohibited techniques written into the rules of engagement. Destructive checks and denial-of-service testing need written approval and a rollback plan.

Question 3

What do we receive at the end?

Accepted Answer

A board-ready executive summary, a technical report with reproducible evidence, business impact and prioritised remediation guidance, a retest of fixed findings and access to the engagement record in HEKSEC Radar.

Question 4

Can you support our compliance program?

Accepted Answer

Yes. We map testing and control evidence to ISO 27001, SOC 2, PCI DSS 4.0, NZISM, APRA CPS 234 and HIPAA. Our vCISO team can own the program or work alongside your existing compliance lead.

Question 5

Do you test cloud and AI systems?

Accepted Answer

We test AWS, Azure, GCP, Kubernetes and the identity layers around them. For AI systems we focus on data exposure, prompt injection, tool-use boundaries and the surrounding application, not model claims.

Question 6

How is our data handled?

Accepted Answer

Engagement data is encrypted in transit and at rest, access is role-based and logged, and retention defaults to 30 days after sign-off unless you ask for longer. New Zealand residency is available. We sign NDAs and DPAs before scoping.

Question 7

What happens if we have an active incident?

Accepted Answer

Email incident@hek.nz. A senior responder triages within 15 minutes, helps you contain the threat and takes over forensic preservation if needed. You do not need to be an existing client to get help.